(untitled)

When people talks about secure ways to communicate from a smartphone, Signal is always is the go-to choice. Except there's a few things that I personally think is annoying with this apps, like the fact it use the internet connection and make your texts go trough a SPOF (even though the transition make sense, see their blogs about it : https://whispersystems.org/blog/goodbye-encrypted-sms ). So how to secure SMS/MMS traffic ? Since last years I've been using a fork of TextSecure 2.6.4, called Silence : https://silence.im As explained in the first link I've put, both apps have their own pros and cons : Pros : >No google services dependencies >No SPOF >Can be your default SMS apps Cons : >No IOS support (there's just no API to rely on). >Except the length of the text, you cannot obfuscate the metadata >Encrypted texts spotted from miles ( https://github.com/SilenceIM/Silence/issues/480 ) >No calls, no video. So, what's your personal opinion ? What do you use to keep you secure ? >inb4 use Antox you pleb pls no

>on /sec/ >2016+1 >using a PTD just carry a librebooted with ricochet. if you can't, your connect will not be more secure if you're using a PTD.

>how to secure SMS/MMS traffic gpg mms is probably the best you can do. using sms relies on the cellular phone system which relies on multiplexing which relies on sim cards which relies on a customer id number and carrier id which is attached to you and can be used to locate your position using base stations and satellites in like 5 different ways. you can register any phone number on signal and use it from a web browser so it's a little bit safer metadata wise. Using the google push notification framework makes sense as it's lighter on battery than sockets and there's not really other infrastructure out there for droid. Plus it has great PR unlike secure.im, Your friends may have heard of it. If the object of the game is to chat securely with as many lay people as possible then pick signal every time. Always validate fingerprints though and be wary of whatsapp and telegram because the implementation is bad. i.e. https://www.schneier.com/blog/archives/2017/01/whatsapp_securi.html

>Encrypted texts spotted from miles I agree with the dev, this is not the concern and we can't do much. This is cryptography, not steganography. It is extremely hard to create a full-functional messaging program and while hiding the presence of encrypted messages, you won't find it from almost all apps... If you want to hide the message you need some sophisticated opsec.

>how to secure SMS/MMS traffic >gpg mms is probably the best you can do. This. btw, even encrypted, it's still not the best mean of communication (in my state sending raw PGP messages over SMS may cause suspicion). Avoid using the whole PSTN at all costs, except networking if you need security.

What about the XMPP protocol? Using an app such as Conversations, ChatSecure, or whatever iOS client with encryption, you can make an account on an XMPP server and chat with encryption using OTR or OMEMO. There will be some metadata, but the contents of the message are secured.

>>72 The Google services dependencies of Signal actually aren't there if you compile it from source. I find it frustrating that they don't provide a non-botnet version in F-Droid or somewhere similair. I used Silence for a while, which was really great and a big pro that it worked over GMS as normal. The problem is that it doesn't work with Signal, and since more people interested in privacy are using that it required me to switch back. Maybe the solution is to have a new standard for SMS which includes end-to-end encryption by default. I imagine there would be a lot of work and it would take time to switch over, but it seems a better alternative than a bunch of third parties competing with products that aren't compatible. I don't want 10 different messaging apps because my friends all use different ones.

>>75 I'm sorry, what does PTD stand for ? >>84 >>99 I've found this app which use Markov-Chained encryption, but the most part is proprietary : https://www.oversec.io The concept seem great, and also work with pgp, but I don't like relying on proprietary code, so I don't think I'll use it.

>>98 you can tunnel it through tor too, but sending anything besides text through it is painful, and it has connectivity problems and sockets drain battery. If you're texting with someone with a lainers level of knowledge it will work, but normal people will find problems with it. I know because i've used conversations with normal people. for the record you should use omemo not otr.

>>100 I'm just shooting in the dark after reading acronyms online, but it might be Personal Trusted Device? Dunno.

>>99 There's actually a signal fork without gcm called Noise in the copperhead fdroid repo

If you haven't compiled your phone's OS, your phone can't be secure no matter what apps you use. XMPP and IRC and secure enough though provided you use OTR.

>>100 PTD = Personal Tracking Device Also known as "smartphone" these days...

>>98 This, Conversations+omemo encryption is the ultimate and most secure way to chat on your phone. If you want a desktop client you may try to look forward to dino. It's new but very promising.

>>109 thanks for your post RMS

>>105 >gcm I first thought was the GCM mode of cipher operation, "what the fuarrrk?", later I realized it was Google.

>>101 XMPP is good and in many cases the best choice and I use it every day. But not suitable for using with Tor. Problem: every XMPP client leaks a significant amount of information, client version, OS info and more, in the way XMPP was designed (Tor Messager is a exception). Even protocols as simple as IRC, we have client infoleak problems (away message, CTCP. etc) if we are not carefully enough, and XMPP is a rather complicated one...

Wait are you just looking to encrypt SMS? The guys who made Signal made TextSecure beforehand, just use that.

>>170 WOW reading comprehension, I literally just saw you mentioning TextSecure in your main post. Disregard.

>>110 Dino seems nice, if ugly by virtue of GTK3. We needed something better than Pidgin for desktops, thank fuarrrk.

>>72 why not antox, though ?

>>818 OP here, I do not want to use Antox for multiple reasons. First, like I said before, my wish was to secure the SMS/MMS flow, and the tox protocol doesn't use theses. Everything will simply go trough your data connection, and that's it. Using tox imply some advantages (like the fact IOS phones can also use it, with Antidote), but aside from the the fact this app is kinda slow, running it in background simply require more energy (because of the P2P architecture) than an average SMS app like Silence, and that's (IMO) the biggest problem. The third reason is based on the fact the tox project is (or was, depending of the developers) using a self-made encryption algorithm, resulting in a lack of reliability. I remember reading an issue about this on the toxcore repository a few weeks ago, and since then I haven't heard about it, so I might be wrong about this last part.

>>818 qTox is awesome and just werks perfectly. Antox is soykaf that works only when you hold its hand. Also voice calls from/to Antox don't exactly work most of the time (for me). But with PTD free of Android and with unlimited bandwidth Tox is the best thing ever. With city-wide free WiFi, proper MAC randomization and Tox over Tor you can have a decentralized phone that doesn't track you.

>>824 For sending chat and picture securely, I admit Antox do the job, but I also agree and that the voice calls aren't working (yet?), so if you want a working and secure alternative, Plumble is the soykaf (if you know or own a mumble server though).

>>825 It probably depends on the phone RAM. For me, voice call and even webcam call work like a charm.

>>101 >sending anything besides text through it is painful you might want to look at XEP-0363 it lets you upload media files encypted to a regular http mini server and is way faster than the regular xmpp in-band transmission

Honestly I wish I'd pressured my normal person friends to use silence instead of signal, because of the SMS functionality. Oh well, signal is pretty good anyway.

Signal is recommended by people I tend to trust. But I just can't bring myself to install an app with an insane permissions list like that. Conversations works for me.

Are using XMPP-servers like creep.im viable while using OMEMO, or it is essential to set up your own server?

Recommended messaging app preference list: Briar Conversations + OMEMO Signal. Conversations + OTR to communicate with users on XMPP clients without OMEMO if they won’t adopt Signal or an OMEMO client Silence encrypted SMS to communicate with Android users without data connections Other apps with end-to-end encryption if you can’t convince contacts to install one of the above (Wire, WhatsApp, etc.) Apps with transport encryption without end-to-end encryption Unencrypted SMS or apps without transport encryption

>What do you use to keep you secure ? Telegram Thank me later

>>2805 Oh boy...

>>2805 thanks CIA

Is there anything wrong with Wire? I managed to convince some people to switch from Discord, but I doubt I could convince them to switch once more

>>2814 Nothing seems wrong with it, but as usual with these services you have to consider how much you trust the provider.

I can't get my friends on Jabber because of 'servers' not making any sense to normal people, OMEMO is only supported by a couple clients, one which you have to pay for unless you use Fdroid, which normal people also don't understand. "How can there be more than one app store?" I've gotten everyone to use Signal though. Audio calls on Signal work well. Groupchats too. A few close friends and I use Tox. I can't get anyone to use Email+GPG with me. >>2805 Oh dear... >>2814 It's websoykaf, and it's run by a profit driven corporation that is shady at best. "Just trust us!"

>because of 'servers' not making any sense to normal people this is a point of no return, say do they understand how email works?

>>81 You're not wrong, but positioning someone using a phone has fuarrrkall to do with satellites.

>>2846 He was referring to GPS. An application can read GPS data, and you can restrict that. But when a BSP has direct memory access, you can't really tell what is going on there and what signals attackers send to it through cellular network. https://en.wikipedia.org/wiki/Enhanced_9-1-1

>>2825 You need better friends.

>>2825 cant even get most of my friends or family to use signal give tips

>>2855 you have to be persistently annoying.

>>2845 They're in the cloud, right?

What about Keybase, guys ? https://keybase.io/

>>2918 Don't use their keys or upload your private one and it might be an ok option. I don't know if it's FOSS or not.

>>2919 Their client is, but they give no source for their website. It has the wanting to watch their spouse have sex with another partner license too.(Don't spill soykaf.)

>secure messaging >not mentioning matrix proto https://matrix.org/

>>2965 >just another XMPP fork yeah)

Is there any way I can Install just the google play services signal requires ? I don't want the google play store or other soykaf on my phone since I don't have any use for it {yalp, fdroid}. Signal without google play services just fuarrrking drains my battery.

>>2971 Try microG https://microg.org/ Or better, stop using Signal and switch to XMPP with OMEMO. It drains your battery because of bad socket implementation. Google services allow Signal to send push messages to you through "Cloud to Device Messaging" platform (i.e. a Google's server) thus exposing your metadata to third party, what you would not want to happen though, right?

>>2972 I can't get spoofing working no matter what method I use so I gave up on microG with Signal. >Or better, stop using Signal and switch to XMPP with OMEMO. For conversations(the app), you have to install fdroid, and then install conversations from there and then use another xmpp server with it. I need something retard proof from google play.

>>2972 >It drains your battery because of bad socket implementation. That's not true at all...

>>2967 It's not an XMPP fork.